Mark Clews

Mark’s experience covers the entire lifecycle of the Electronic Discovery Reference Model (EDRM). From providing proactive guidance in relation to information governance and discovery readiness consulting, through to preservation, processing, and review of data for production purposes. Mark has led hundreds of engagements on a wide variety of matters ranging from forensic analysis of a single machine through to multi-jurisdictional class action disputes containing hundreds of custodians.

Mark has extensive experience navigating his clients through the challenges of responding to government and regulatory investigations, including the Securities and Exchange Commission, Consumer Financial Protection Bureau, Department of Justice, Environmental Protection Agency, Office of the Inspector General, Financial Industry and Regulatory Authority, Federal Trade Commission, and the Attorney General’s Office. His project experience includes investigating the operation of illegal cartels, theft of intellectual property, accounting irregularities, securities class actions, Qui Tam whistleblower suits, and other fraudulent activities.

Mark’s professional experience includes:

• Mark was retained by a health insurance company as the digital forensic expert to assist in their response to the National Association of Insurance Carriers (NAIC) after a suspected data breach. Mark was tasked with interviewing data stewards within the company and identifying potential sources of evidence. Once identified, Mark and his team preserved all the potentially relevant data sources in a defensible manner. Data for over 70 custodians was successfully preserved. Data sources included laptops, email, instant messages, removable drives, network collections, websites, blogs, social media accounts, and virtual machines.
• Mark was retained by a healthcare provider to assist them respond to a whistleblower lawsuit. He was tasked in overseeing the defensible collection of over 300 electronic devices totaling 50 terabytes of data. Devices in scope included desktops, laptops, local email, cloud based file repositories, cloud based email, removable drives, server shares, mobile devices, and accounting systems. Once the data had been successfully preserved, Mark managed the identification, extraction, data processing, review, and production of the potentially relevant data. He worked closely with the custom application team to develop a custom solution to achieve efficient review of mobile device artifacts leveraging multiple reviewers.
• Mark was appointed the independent forensic expert in a Financial Industry Regulatory Authority (FINRA) arbitration. He was tasked with auditing a telecommunications company’s identification and preservation processes, which were ultimately deemed insufficient. Mark managed the restoration of backup tapes from the time of the original collection and ran search terms across the data to identify responsive documents. He then used forensic techniques to remove duplicates and create a differential delivery to the other parties in both Concordance and Summation formats. His assistance on this matter led to a substantially larger document set being identified for disclosure.
• Mark was appointed as the digital forensic expert in a theft of intellectual property case on behalf of a television network. Mark was tasked with reviewing the opposing side’s forensic expert’s methodology, and observations. Mark was able to successfully challenge the contents of his report, resulting in the judge agreeing to all of the plaintiff’s requests and ultimately led to an out of court settlement.
• Mark was appointed as the forensic expert to assist a social media company respond to a Securities and Exchange Commission (SEC) investigation relating to their initial public offering (IPO). Mark managed the forensically sound collection and analysis of over 100 digital devices including laptops, desktops, tablets, and mobile devices. During the case, Mark successfully audited the performance of two email archiving tools, Enterprise Vault and Proofpoint.
• Mark was appointed as a forensic expert to investigate allegations of theft of intellectual property from an auto-financing company. Mark was able to rebuild the timeline and reconcile user activity from the client’s CRM system and the custodian’s laptop. Mark was able to locate evidence artifacts that indicated that the custodian had downloaded customer lists prior to leaving employment. Using forensic techniques, Mark was able to identify a USB device which had been used to transfer the intellectual property outside the enterprise.
• Mark investigated a large internet service provider (ISP) for accounting irregularities on behalf of the Securities and Exchange Commission (SEC). He led the computer forensics team in analyzing all electronic evidence to identify potentially relevant data. He established a workflow using Guidance Software’s EnCase to filter out system file types and known files based on a comparison of the NSRL’s known hash database. He also oversaw the subsequent loading of these files into Attenex for attorney review. Mark’s work on this project assisted the SEC in reaching a $300 million penalty settlement with the ISP.